Authentication

# Google OAuth
GOOGLE_AUTH_ENABLED=true
GOOGLE_OAUTH_CLIENT_ID=your_client_id
GOOGLE_OAUTH_CLIENT_SECRET=your_client_secret

# GitHub OAuth
GITHUB_AUTH_ENABLED=true
GITHUB_OAUTH_CLIENT_ID=your_client_id
GITHUB_OAUTH_CLIENT_SECRET=your_client_secret

from enferno.user.models import User
from enferno.user.forms import RegisterForm

@app.route('/register', methods=['POST'])
def register():
    form = RegisterForm()
    if form.validate_on_submit():
        user = User(
            email=form.email.data,
            password=form.password.data,
            active=True
        )
        user.save()
        return jsonify({'message': 'Registration successful'})
    return jsonify(form.errors), 400

from flask_security import roles_required, roles_accepted

@app.route('/admin')
@roles_required('admin')
def admin_dashboard():
    return 'Admin only content'

@app.route('/premium')
@roles_accepted('premium', 'admin')
def premium_content():
    return 'Premium or admin content'

from flask_security import auth_token_required

@app.route('/api/protected')
@auth_token_required
def protected_endpoint():
    return jsonify({'message': 'Authenticated access'})

from flask_security.utils import get_token_status

def generate_auth_token(user):
    token = user.get_auth_token()
    return jsonify({
        'token': token,
        'expires': get_token_status(token)['exp']
    })

# Security Settings
SECURITY_PASSWORD_SALT=your_secure_salt
SECURITY_TOTP_SECRETS=your_totp_secrets
SECURITY_REGISTERABLE=true
SECURITY_CONFIRMABLE=true
SECURITY_RECOVERABLE=true
SECURITY_TRACKABLE=true
SECURITY_PASSWORD_LENGTH_MIN=8
SECURITY_TOKEN_MAX_AGE=86400

from flask_security import two_factor_required

@app.route('/sensitive')
@two_factor_required
def sensitive_data():
    return 'Two-factor authenticated content'

from flask_security import webauthn_required

@app.route('/webauthn-protected')
@webauthn_required
def webauthn_protected():
    return 'WebAuthn authenticated content'

# Session Configuration
SESSION_PROTECTION = 'strong'
PERMANENT_SESSION_LIFETIME = timedelta(days=1)
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Lax'

uv add flask-limiter

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

limiter = Limiter(app, key_func=get_remote_address)

@app.route('/login', methods=['POST'])
@limiter.limit("5 per minute")
def login():
    pass